# Privacy Policy > Privacy policy for Electric Social / The Loft Berlin GmbH — controller, cookies, tracking, and processors. - Canonical page: https://www.electric-social.com/en/privacy/ - Language: en ## Privacy Policy Last updated: August 2026 ### 1. Controller The controller responsible for personal data processing on this website is: **The Loft Berlin GmbH** (brand: Electric Social) Grunerstr. 13 10179 Berlin Germany Phone: +49 (0) 30 213002140 Email: alex@electric-social.com ### 2. Hosting and delivery This website is served via **Cloudflare Pages** (CDN and hosting). When you load pages, the host processes technical connection data (including IP address, time, requested URL, referrer, user agent) as needed to deliver, secure, and stabilise the site. - **Processor:** Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (and affiliated EU/EEA entities where applicable) - **Legal basis:** Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation) - **Third-country transfers:** USA — safeguarded by Cloudflare’s contractual guarantees (including Standard Contractual Clauses / DPA) where required Access logs are retained only as long as needed for operations, security, and troubleshooting. ### 3. Cookies and consent We use cookies and similar technologies. - **Strictly necessary cookies** (e.g. storing your cookie choice) may be set under § 25(2) TDDDG and Art. 6(1)(f) GDPR. - **Analytics, marketing, and personalisation cookies/tags** are used only with your **consent** (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Consent is collected via the **TermsFeed** cookie banner. You can change or withdraw your choice at any time via “Cookie Preferences” / “Cookie-Einstellungen” in the footer. Withdrawal applies going forward. We use **Google Consent Mode** so that, until you consent, settings such as `analytics_storage` and `ad_storage` remain denied by default. ### 4. Contact and application forms Forms on this site (contact, careers, etc.) let you send us messages. At least a valid email address is required; other fields are optional. We process the data only to handle your enquiry or application. - **Legal basis:** Art. 6(1)(b) GDPR (pre-contractual / enquiry) and/or Art. 6(1)(a) where you separately consent to marketing - **Processor (form backend / anti-spam):** SpamBlock (spamblock.io / related operator), including `api.spamblock.io` and `pixel.spamblock.io` Retention: until your request is resolved, then as required by statutory retention rules where applicable. ### 5. Online reservations (OpenTable) Table and experience bookings use links and a booking widget from **OpenTable**. When you use them, OpenTable processes reservation details such as your name, email address, phone number, date, party size and requests. We receive the details needed to manage your reservation. For more information, see [OpenTable’s privacy policy](https://www.opentable.de/c/legal/privacy-policy/). - **Provider:** OpenTable GmbH (and affiliates) - **Our purpose:** Enabling and managing reservations for Electric Social - **Legal basis:** Art. 6(1)(b) GDPR (contract / pre-contractual steps); embed technology may also rely on legitimate interest (f) or consent where third-party cookies are involved ### 6. Analytics, advertising, optimisation, and other services After consent (or where otherwise permitted), **Google Tag Manager (GTM-5MPMTZJ3)** and direct embeds may activate the services below. Some GTM tags may be paused; this list covers **configured / embedded** processors for the website. #### 6.1 Google Tag Manager, Google Analytics 4, Google Ads - **Provider:** Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent Google LLC, USA - **Purpose:** Tag management, reach measurement, conversion and campaign measurement - **Legal basis:** Consent (Art. 6(1)(a) GDPR), unless strictly technical #### 6.2 Meta Pixel (Facebook / Instagram) - **Provider:** Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; Meta Platforms, Inc., USA - **Purpose:** Campaign and event measurement (e.g. booking intent) - **Legal basis:** Consent #### 6.3 TikTok Pixel - **Provider:** TikTok Technology Limited, Ireland / TikTok Inc., USA (depending on configuration) - **Purpose:** Campaign and event measurement - **Legal basis:** Consent #### 6.4 Microsoft Clarity - **Provider:** Microsoft Ireland Operations Limited / Microsoft Corporation, USA - **Purpose:** Usage analysis (e.g. session insights) - **Legal basis:** Consent #### 6.5 VWO (Visual Website Optimizer) - **Provider:** Wingify Software Private Limited, Delhi, India (product: VWO) - **Purpose:** A/B testing and site optimisation (SmartCode via Google Tag Manager after analytics consent)\ - **Legal basis:** Consent and/or legitimate interest in optimisation — aligned with cookie consent #### 6.6 Ahrefs Web Analytics - **Provider:** Ahrefs Pte. Ltd., Singapore - **Purpose:** Website analytics (`analytics.ahrefs.com`) - **Legal basis:** Consent and/or legitimate interest, consistent with consent setup #### 6.7 TermsFeed (cookie banner) - **Provider:** TermsFeed (consent / compliance tooling) - **Purpose:** Collecting and storing cookie preferences - **Legal basis:** Art. 6(1)(c)/(f) GDPR with TDDDG (legal obligation / proof of consent) #### 6.8 CDN for libraries (jsDelivr) We load styles and scripts (e.g. calendar and site components) via the **jsDelivr** CDN. Your IP address may be transmitted to the CDN operator. - **Purpose:** Delivering static assets - **Legal basis:** Art. 6(1)(f) GDPR ### 7. Processors and key recipients | Service | Typical role | Purpose | |---------|----------------|---------| | Cloudflare, Inc. | Processor | Hosting / CDN / security | | Google Ireland Ltd. / Google LLC | Processor / controller for Ads features | GTM, GA4, Ads | | Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Joint / independent controller (pixel) | Ads measurement | | TikTok Technology Ltd. / TikTok Inc. | Joint / independent controller (pixel) | Ads measurement | | Microsoft / Clarity | Processor | UX analytics | | Wingify / VWO | Processor | Testing & optimisation | | Ahrefs Pte. Ltd. | Processor | Web analytics | | TermsFeed | Processor | Cookie consent | | SpamBlock | Processor | Forms / anti-spam | | OpenTable GmbH | Independent controller / reservation platform | Online booking | | jsDelivr | Recipient of technical data | CDN | Sub-processors of the above (e.g. Google/AWS cloud infrastructure) follow each vendor’s current DPA and sub-processor lists. On request we can point you to the agreements that apply to us (AVV / DPA). ### 8. Sharing and third countries We share personal data with third parties only if you consented, if it is needed to perform a contract, if we are legally obliged, or if we have a legitimate interest that is not overridden by your interests. Transfers to the USA or other third countries use **EU Standard Contractual Clauses** and vendors’ supplementary measures where required. ### 9. Retention We keep personal data only as long as needed for the purposes above or as required by law. Consent-based tracking data stops on withdrawal or per each tool’s deletion rules. ### 10. Your rights Under the GDPR you have the right to: - Access (Art. 15) - Rectification (Art. 16) - Erasure (Art. 17) - Restriction of processing (Art. 18) - Data portability (Art. 20) - Withdraw consent (Art. 7(3)) - Lodge a complaint with a supervisory authority (Art. 77), e.g. the Berlin Commissioner for Data Protection and Freedom of Information To exercise these rights, email **alex@electric-social.com**. ### 11. Objection (Art. 21 GDPR) Where we rely on legitimate interest (Art. 6(1)(f)), you may object on grounds relating to your particular situation. You have an unconditional right to object to processing for direct marketing. ### 12. Security We use TLS/HTTPS and appropriate organisational and technical measures to protect data against loss, manipulation, and unauthorised access. ### 13. Updates This privacy policy is effective **August 2026**. We update it when needed; the current version is this page.